Production-ready Google Drive + OneDrive/SharePoint Sync and Write-back

Somebody on the team says: "Let's just sync their Google Drive."

And you think — sure, how hard can it be? OAuth, list some files, download them. Maybe a webhook for changes. Toss in OneDrive for the enterprise crowd. Ship it by Friday.

I spent the better part of a month learning exactly how hard it can be. I evaluated 17 vendors, read more OAuth documentation than any human should, got intimately familiar with Google's compliance process, and emerged with a map of the trade-off space that I wish had existed when I started.

This is that map.

---

The Impossible Hexagon

Here are six things you'd like to be true simultaneously:

1. Bulk recursive background sync for Google Drive AND OneDrive/SharePoint
2. Skip Google's restricted-scope verification (the dreaded CASA audit)
3. Skip admin consent for Microsoft Graph
4. Stay fully white-label — no third-party branding on consent screens
5. Spend less than $300/mo on third-party tooling
6. Minimize user friction — no multi-step consent flows

You cannot have all six. One or more constraints must bend. The entire article is about choosing which ones.

I call this the Impossible Hexagon because it sounds dramatic and because I spent enough time staring at it on a whiteboard that it deserves a name.

---

Two Roads Diverged in a Cloud Storage Wood

Every real-world implementation falls into one of two paths. There is no third path. I checked.

Path 1 — The Admin Bypass (Enterprise / B2B)

This is the elegant path if your users have IT departments. An admin performs a one-time "moment of consent":

• Google Workspace: Domain-Wide Delegation via a Service Account — your app impersonates users without them ever seeing an OAuth screen
• Microsoft 365: Admin-granted Application Permissions in Entra ID — same idea, different console

After that moment, your backend crawler runs quietly in the background. No per-user OAuth. No CASA audit. No consent screens. Just changes.list and delta queries chugging along.

The catch? You need an IT admin who trusts you enough to hand over the keys. For consumer products, this path doesn't exist.

DWD caveat (March 2026): Google has been tightening domain-wide delegation guidance and encouraging more granular alternatives. Some security-conscious enterprises are moving away from blanket DWD toward more constrained service account patterns. B2B onboarding should anticipate that some prospects' IT teams may push back on DWD — plan a fallback conversation and consider offering granular scope restrictions as an alternative.

Path 2 — Consumer Self-Serve

For products where individual users connect their own Drive or OneDrive, you're in the trenches. Three options, ranked:

The move: Ship with Pipedream Connect in weeks. Begin CASA process immediately. Migrate to Nango once you have traction and the compliance runway.

---

The Vendor Gauntlet: 17 Providers, Evaluated

I looked at everything. Here's the full evaluation matrix — the highlighted rows (Nango and Pipedream Connect) are the survivors; the rest are kept as a decision log.

Survivors: Nango and Pipedream Connect. Everything else was either too expensive, too limited, or solving a different problem.

---

OAuth Scopes: Where Dreams Go to Die

This is the section that will save you the most time. Trust me.

Google Drive — The Restricted Scope Trap

See the problem? The one scope that doesn't require compliance review (drive.file) can only access files your app created. It cannot enumerate or read existing user files. You literally cannot build a file sync product with it.

Every production Drive sync implementation requires restricted scopes. There is no workaround. CASA is not optional — it's a toll road with no side streets.

Microsoft Graph — The Admin Consent Wall

Microsoft's *.All scopes trigger admin consent prompts in most tenant configurations. Your users will hit a screen that says "This app needs admin approval" — and unless they are the admin, that's a dead end.

The silver lining: Microsoft's compliance process is lighter. Publisher verification through MPN, a blue badge, done. Selected permissions can help narrow scope. No annual audit.

---

The CASA Gauntlet

Google's Cloud Application Security Assessment. Annual. Mandatory for restricted scopes. Here's what you're signing up for:

Minimum product controls (verification friction reducers):

• Least-privilege scopes with clear justification (why read-all; why write)
• Encryption at rest for tokens + files; secret management; audit logging; delete/export flows
• Vulnerability scanning evidence (SAST/DAST/SCA) + remediation process

Compare that to Microsoft:

Google makes you earn it every year. Microsoft trusts you after the first date. Make of that what you will.

---

Four Architecture Patterns

Every implementation I've seen (or built, or considered building) maps to one of these four patterns. The diagrams tell the story.

Pattern 1 — The Quick Import (Frontend Picker + Server Transfer)

For when you just need files once — no ongoing sync, no delta tracking. A picker widget (Uploadcare, Filestack), a webhook, done.

Simple. The vendor handles OAuth, fetches files server-to-server, drops them in your bucket. But there's no background sync, no delta tracking, and no write-back. This is a one-way import, not a sync engine.

Pattern 2 — The Managed Middle Ground (Vendor OAuth + Background Crawler)

This is the Pipedream Connect path. You get managed OAuth and ongoing sync capability without building token management from scratch.

The vendor handles tokens. You handle sync logic — cron jobs or queue workers calling their unified API to list files, download content, and push write-backs. You're trading some control (and white-label purity) for speed to production.

Pattern 3 — The Full Monty (BYO OAuth + Nango Token Vault + Background Crawler)

The long-term architecture. You own everything: OAuth apps, token management (via Nango or custom), sync workers, conflict resolution. Maximum control. Maximum effort.

Your workers hit Google's changes.list and Microsoft's delta endpoints directly. You control retry logic, rate limiting, conflict resolution, and exactly how write-backs propagate. This is what you migrate to after Pipedream proves the market.

Pattern 4 — The Enterprise Express (Admin-Granted Flows)

The B2B path. An IT admin grants access once, your backend syncs everything silently. No per-user consent, no CASA, no friction.

This is the path where compliance and user friction simply... vanish. The trade-off is that someone with admin access has to say yes first.

---

The Rollout Playbook

Enterprise (B2B) — Ship in 2–3 Weeks

• Architecture: Pattern 4
• Compliance: None required — DWD and Application Permissions bypass CASA entirely
• Timeline: 2–3 weeks if you already have a backend and job queue infrastructure
• Risk: Low — the admin consent model is well-understood and battle-tested

Consumer (Self-Serve) — Ship Fast, Then Own It

Phase 1 (Near-term): Option C — Pipedream Connect, Pattern 2

• Ship in 2–3 weeks
• Start CASA process on day one (it runs in the background while you ship)
• Accept Pipedream's branding on consent screens temporarily

Phase 2 (Long-term): Option A — Nango, Pattern 3

• Migrate once you have product-market fit and the CASA approval
• Full white-label, lower cost at scale
• Plan 10–15 weeks of engineering effort

---

Questions for the Business Team

Before writing a single line of integration code, four questions need answers. These aren't technical decisions — they're business decisions that determine the technical path:

1. Self-serve or IT-admin install? This is the fork in the road. Both is fine, but build one first. Many B2B products start with admin install (faster, no CASA) and add self-serve later.

2. Speed to market vs. white-label purity? Pipedream gets you live in weeks. Your consent screens say "Pipedream" instead of your brand. Is that acceptable for V1? (It usually is.)

3. Expected data volumes? A 10-user pilot and a 10,000-seat enterprise have very different infrastructure needs. Delta sync strategies, storage costs, and rate limits all scale differently. Know your target.

4. Sales fallback if self-serve stalls? If consumer adoption is slow, can the product pivot to sales-led B2B? Having Pattern 4 ready as a fallback can derisk the entire launch. Build the admin flow even if you don't lead with it.

---

Parting Thoughts

I started this research thinking I'd find a clean vendor that "just handles" cloud storage sync. I ended it understanding why that vendor doesn't exist — and why the problem space is more constrained than it appears.

The constraints are real. Google's restricted scope policy isn't going away. Microsoft's admin consent wall isn't going away. CASA renewals are annual. But the problem is solvable, and the paths above have been pressure-tested against real production requirements.

Pick the path that matches your current stage, not your aspirational one. Ship with Pipedream if you need to be live next month. Plan the Nango migration for when you've proven the market cares. And if you're selling to enterprises — Pattern 4 is right there, waiting for an IT admin to click "Approve."

Good luck out there. Your OAuth tokens are going to expire at the worst possible time. They always do.

---

Sources

1. Google restricted-scope verification
2. Google Drive API OAuth scopes
3. Google changes.list API
4. Google Domain-Wide Delegation
5. Google Trust & Safety review
6. CASA Tier 2 overview (App Defense Alliance)
7. CASA assessment pricing — TAC Security
8. Microsoft Graph permissions reference
9. Microsoft admin consent configuration
10. Microsoft Publisher Verification
11. Microsoft Graph delta API (OneDrive)
12. Microsoft selected permissions
13. Nango — Google integration docs
14. Nango — Google security review guide
15. Nango pricing
16. Pipedream Connect — connected accounts
17. Pipedream pricing
18. Pipedream Connect API proxy
19. Merge — file storage API
20. Merge pricing
21. Unified.to — storage API
22. Apideck — file storage reference
23. Uploadcare — upload sources
24. Filestack — picker docs
25. Uppy — Google Drive plugin
26. Composio
27. n8n — Google OAuth credentials
28. SurrealDB
29. drive.file scope limitations (Stack Overflow)
30. Microsoft Entra admin consent workflow